{"id":"CVE-2026-114114","summary":"Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters","details":"Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with non-ASCII identifiers that NFKC-normalize to ASCII, or an invisible byte-order mark, can silently substitute addresses, integers or other constants in compiled code.","aliases":["GHSA-r3c7-7xwm-6vfw"],"modified":"2026-10-21T10:45:46.760950382Z","published":"2026-10-21T00:37:12.518Z","database_specific":{"cwe_ids":["CWE-176"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114114.json","unresolved_ranges":[{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StandardRange","range":[{"introduced":"0.1.0b1"},{"fixed":"0.1.0b12"},{"introduced":"0.1.0b14"},{"fixed":"0.1.0b15"}]}]}],"cna_assigner":"VulnCheck"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114114.json"},{"type":"ADVISORY","url":"https://github.com/vyperlang/vyper/security/advisories/GHSA-r3c7-7xwm-6vfw"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114114"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/vyper-through-0.5-0b1-literal-value-substitution-via-multi-byte-characters"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vyperlang/vyper","events":[{"introduced":"8a93dd27de503b0a3ace36d961a10c9ea4adee8b"},{"last_affected":"577d2534356903076bb79b5b15ebd4d772994693"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"0.4.1"},{"last_affected":"0.5.0b1"}],"source":"AFFECTED_FIELD"}]}}],"versions":["v0.5.0b1","v0.5.0a3","v0.5.0a2","v0.5.0a1","v0.4.3","v0.4.3rc1","v0.4.2","v0.4.2rc1","v0.4.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114114.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"}]}